Recognizing the need for broader data protection measures in an increasingly digitized world, California has enacted SB 362, more commonly referred to as the Delete Act. On October 10, Governor Newsom signed the act into law spurring a wave of additional disclosure and registration obligations on data brokers, changing the landscape of data regulation as we know it.
The Delete Act amends the existing data broker law in California, transforming the way data brokers are expected to manage requests regarding the deletion of user data. Most notably, the act mandates that data brokers support deletion requests through a unified “deletion mechanism.” This unique tool is to be developed and maintained by the California Privacy Protection Agency (CPPA), a body introduced by the California Privacy Rights Act in 2020 to help define and enforce data protection rights for citizens.
This aggressive new strategy towards the regulation of data brokers is set to shake up existing business models within the industry. By imposing these extensive additional disclosure and registration requirements, companies dealing with data must strive to be more transparent, accountable, and responsive to user requests.
Those entities that qualify as a ‘data broker’, defined as businesses that knowingly collect and sell personal information about consumers with whom they have no direct relationship, will be primarily affected. Not only are they mandated to register with the Attorney General but also must disclose certain information, significantly expanding the earlier law’s disclosure requirements.
As we’ve seen, advancements in online technology have provided widespread access to consumer data, leading to severe privacy concerns. Given this digital era, the Delete Act is being seen as a needed step in rebalancing the scales, affording California’s consumers more control and transparency over their data.
For more information on the Delete Act and its implications, you can read about it here. Legal professionals across the globe, particularly those representing corporations handling large volumes of user data, should keep an observant eye on the unfolding regulatory landscape in California. With its powerful influence on national and global policy, other jurisdictions may soon follow suit with similar data privacy measures.